@worca/app 1.5.0 → 1.6.0-rc.1

package/src/core/claude-runner.mjs

@@ -39,9 +39,10 @@
 
 import { spawn } from 'node:child_process';
 import { createInterface } from 'node:readline';
-import { prepareModelEnv, envFlag, describeModelEnv } from './model-env.mjs';
+import { prepareModelEnv, envFlag, describeModelEnv, withProviderModesOff } from './model-env.mjs';
 import { effectiveDebugSpawn } from './settings.mjs';
 import { classifyError, strongestClass } from './recoverable-error.mjs';
+import { bridgeEvents } from './bridge/telemetry.mjs';
 import { explainUnspawnableClaude, resolveClaudeBin } from './preflight.mjs';
 import { hostGuardEnabled, hostGuardHookEntry, hostGuardSystemPrompt } from './host-guard.mjs';
 // The offline classifier and the shape normalizer the mock ask role answers
@@ -54,6 +55,12 @@ import { dirname, join } from 'node:path';
 import { tmpdir } from 'node:os';
 import { stripGithubCredentials } from './github-credentials.mjs';
 import { agentIdentity, agentSpawn, killAgentGroup, shareWithAgent } from './agent-user.mjs';
+import { agentIdentityFor } from './agent-pool.mjs';
+import { brokerEnabled, brokerInfo, mintSpawnToken, revokeSpawnToken, slotBaseUrl, slotOfBaseUrl } from './broker-client.mjs';
+import { resolveBillTo, normalizeBillTo, currentOwner } from './billing.mjs';
+import { redactSecrets, redactDeep } from './redact.mjs';
+import { MODEL_CREDENTIAL_ENV_KEYS } from './broker-guard.mjs';
+import { modelSlot } from './broker-routing.mjs';
 
 const DEFAULT_BIN = process.env.WORCA_CLAUDE_BIN || process.env.ORCH_CLAUDE_BIN || 'claude';
 
@@ -163,6 +170,39 @@ function spawnFailure(bin, err, prefix) {
 // line as stderr streams (see rlErr) and stamped on the error as `errorClass`.
 const STDERR_DETAIL_MAX = 2000;
 
+// stderr lines the CLI prints on spawns that go on to succeed, which are never
+// the cause of a failure. `[claude-code:unrecognized_model]` fires on EVERY spawn
+// whose model id the CLI does not know — every bridged or endpoint-routed catalog
+// id — so as exit detail it masked the real cause (a 429 carried on the stdout
+// result) and classified null, which kept the rate-limit retry from running.
+// Such a line is still streamed as a stderr event; it only stops being evidence.
+export const BENIGN_STDERR_PATTERNS = Object.freeze([
+  /^\[claude-code:unrecognized_model\]/,
+]);
+
+/** Whether a stderr line is a known-benign CLI notice (BENIGN_STDERR_PATTERNS). */
+export function isBenignStderrLine(line) {
+  const t = String(line ?? '').trim();
+  return !!t && BENIGN_STDERR_PATTERNS.some((re) => re.test(t));
+}
+
+// A bridged spawn's base URL names its catalog id and run tag (bridge/server.mjs
+// bridgeBaseUrl: …/m/<id>[/r/<tag>]). Null for any other endpoint.
+const BRIDGE_PATH_RE = /\/m\/([^/?#]+)(?:\/r\/([^/?#]+))?\/?$/;
+function bridgeSpawnKey(modelEnv) {
+  const url = modelEnv && typeof modelEnv.ANTHROPIC_BASE_URL === 'string' ? modelEnv.ANTHROPIC_BASE_URL : '';
+  const m = /^https?:\/\/127\.0\.0\.1:\d+\//.test(url) ? BRIDGE_PATH_RE.exec(url) : null;
+  if (!m) return null;
+  try {
+    return { catalogId: decodeURIComponent(m[1]).toLowerCase(), tag: m[2] ? decodeURIComponent(m[2]) : '' };
+  } catch { return null; }
+}
+
+// The CLI reports an upstream API failure as an assistant text block ("API Error:
+// Request rejected (429) · …"), usually repeated in the is_error result. The
+// assistant copy is kept as the fallback detail for an exit without a result.
+const API_ERROR_TEXT_RE = /^API Error\b/;
+
 /**
  * Translate a pipeline "effort" level into claude CLI argv additions. This is
  * the ONE place that knows the CLI surface for effort.
@@ -400,6 +440,13 @@ export async function runClaude(o = {}) {
     // A pipeline agent (phases.mjs): runs as WORCA_AGENT_USER when the container set one
     // up (agent-user.mjs). Server-side helpers and Ask Worca leave it unset.
     asAgent,
+    // Credential broker (broker-client.mjs): who pays for this spawn, what kind it is (sets
+    // its token's lifetime), and the run/thread it belongs to. All optional: the person
+    // otherwise comes from the async context (billing.mjs). Ignored with the broker off.
+    billTo,
+    spawnKind,
+    runId,
+    threadId,
     bin = DEFAULT_BIN,
   } = o;
 
@@ -417,7 +464,7 @@ export async function runClaude(o = {}) {
     return runMock({ cwd, systemPrompt, prompt, onEvent, signal, resumeSessionId, workspaceWriteTargets, permissionMode });
   }
 
-  return runReal({
+  return (brokerEnabled() ? runViaBroker : runReal)({
     cwd,
     systemPrompt,
     prompt,
@@ -447,9 +494,120 @@ export async function runClaude(o = {}) {
     addDirs,
     argvInlineLimit,
     asAgent,
+    billTo,
+    spawnKind,
+    runId,
+    threadId,
   });
 }
 
+// ── Credential broker ────────────────────────────────────────────────────────
+// With WORCA_BROKER_URL set (plans/credential-broker-design.html §5.2), worca holds
+// no model credential. Each spawn gets its own short-lived token from the broker and
+// talks to `<broker>/p/<slot>`; the broker adds the paying person's key on the way
+// out. The token is revoked when the process exits, and never survives in anything
+// worca stores: events and error text pass through redactSecrets.
+
+/** Error in the recovery classes the orchestrator already knows (auth pauses, never retries blindly). */
+function brokerSpawnError(message, errorClass = 'auth') {
+  const err = new Error(`worca-broker: ${message}`);
+  err.errorClass = errorClass;
+  return err;
+}
+
+function isLoopbackUrl(v) {
+  try {
+    const h = new URL(v).hostname.replace(/^\[|\]$/g, '');
+    return h === '127.0.0.1' || h === 'localhost' || h === '::1';
+  } catch { return false; }
+}
+
+/** Which broker slot a spawn's model env routes to: {slot}, {bridge:true}, or {error}. */
+export function brokerRouteFor(modelEnv, env = process.env) {
+  const base = modelEnv && typeof modelEnv.ANTHROPIC_BASE_URL === 'string' ? modelEnv.ANTHROPIC_BASE_URL.trim() : '';
+  if (!base) return { slot: 'anthropic' };
+  const slot = slotOfBaseUrl(base, env);
+  if (slot) return { slot };
+  // worca's own in-process bridge (bridge/server.mjs): it reaches a keyless local
+  // endpoint itself; the broker guard refuses any bridged entry that holds a key.
+  if (isLoopbackUrl(base)) return { bridge: true };
+  let host = base;
+  try { host = new URL(base).host; } catch { /* keep the raw value */ }
+  return { error: `this model routes to ${host} directly; with the credential broker on, a model must use a broker slot (set its credential in Settings › Models)` };
+}
+
+const SPAWN_TTL_SEC = { aux: 600, test: 600, ask: 7200, phase: 86400 };
+
+async function runViaBroker(opts) {
+  const route = brokerRouteFor(opts.modelEnv);
+  if (route.error) throw brokerSpawnError(route.error);
+  const onEvent = opts.onEvent;
+  const redactingOnEvent = (e) => onEvent(redactDeep(e));
+
+  let info;
+  try { info = await brokerInfo(); }
+  catch (err) { throw brokerSpawnError(err.message, 'network'); }
+
+  // A bridged model (OpenAI, OpenRouter, Copilot, a gateway): the CLI still talks to worca's
+  // loopback bridge, which translates, but it presents THIS spawn's broker token and the
+  // bridge forwards it to the model's slot. A keyless local endpoint needs no token.
+  let bridgeSlot = null;
+  if (route.bridge) {
+    const ms = modelSlot(opts.model);
+    if (ms && ms.error) throw brokerSpawnError(ms.error);
+    if (!ms || ms.keyless) {
+      try {
+        const r = await runReal({ ...opts, onEvent: redactingOnEvent });
+        return { ...r, text: redactSecrets(r.text) };
+      } catch (err) { if (err && typeof err.message === 'string') err.message = redactSecrets(err.message); throw err; }
+    }
+    bridgeSlot = ms.slot;
+  }
+  let billTo = resolveBillTo(opts.billTo);
+  if (info.mode === 'multi' && (!billTo || billTo === 'local')) {
+    billTo = normalizeBillTo(process.env.WORCA_BROKER_SYSTEM_BILL_TO);
+    if (!billTo) throw brokerSpawnError('this action has no signed-in person to bill it to. Start it from the web UI, or set WORCA_BROKER_SYSTEM_BILL_TO for work nobody in particular starts');
+  }
+  const kind = ['aux', 'test', 'ask', 'phase'].includes(opts.spawnKind) ? opts.spawnKind
+    : (opts.permissionMode === 'dontAsk' ? 'ask' : 'phase');
+  // Whether this spawn runs where no other person's agent can read it: an agent spawn under
+  // the paying person's own pool user (not a resumed run's starter's), or a server-side spawn
+  // when agents run under their own users (they can't read the server's processes). The
+  // broker uses a personal Claude subscription only for such spawns.
+  const owner = normalizeBillTo(currentOwner()) || billTo;
+  const isolated = opts.asAgent
+    ? owner === billTo && !!agentIdentityFor(owner)?.dedicated
+    : !!agentIdentity();
+  let minted;
+  try {
+    minted = await mintSpawnToken({
+      billTo: billTo || 'local', slots: [bridgeSlot || route.slot], kind, ttlSec: SPAWN_TTL_SEC[kind],
+      runId: opts.runId || null, threadId: opts.threadId || null, isolated,
+    });
+  } catch (err) {
+    throw brokerSpawnError(`cannot get a token for this spawn: ${err.message}`, err.status === 401 ? 'auth' : 'network');
+  }
+  const modelEnv = bridgeSlot
+    // Bridged: keep the bridge URL (and the rest of the resolved env); swap the bridge's own
+    // secret for the spawn token.
+    ? { ...opts.modelEnv, ANTHROPIC_AUTH_TOKEN: minted.token }
+    : withProviderModesOff({
+      ENABLE_TOOL_SEARCH: 'true',
+      ...(opts.modelEnv || {}),
+      ANTHROPIC_BASE_URL: slotBaseUrl(route.slot),
+      ANTHROPIC_AUTH_TOKEN: minted.token,
+    });
+  try {
+    const r = await runReal({ ...opts, modelEnv, onEvent: redactingOnEvent });
+    return { ...r, text: redactSecrets(r.text) };
+  } catch (err) {
+    if (err && typeof err.message === 'string') err.message = redactSecrets(err.message);
+    throw err;
+  } finally {
+    revokeSpawnToken(minted.spawnId);
+  }
+}
+
 // ── Real execution ───────────────────────────────────────────────────────────
 
 /** Pure argv builder for the headless claude spawn (exported for tests).
@@ -601,7 +759,7 @@ export function stageClaudeInvocation(opts, { bin = DEFAULT_BIN, limit = ARGV_IN
   return { ...plan, dir };
 }
 
-function runReal({ cwd, systemPrompt, prompt, allowedTools, permissionMode, model, effort, onEvent, signal, bin, resumeSessionId, mcpConfigPath, mcpServerGrants, permissionRules, envScrub, envAllowlist, modelEnv, disallowedTools, tools, strictMcpConfig, settingSources, disableSlashCommands, includePartialMessages, maxTurns, maxBudgetUsd, appendSubagentSystemPrompt, addDirs, argvInlineLimit, asAgent }) {
+function runReal({ cwd, systemPrompt, prompt, allowedTools, permissionMode, model, effort, onEvent, signal, bin, resumeSessionId, mcpConfigPath, mcpServerGrants, permissionRules, envScrub, envAllowlist, modelEnv, disallowedTools, tools, strictMcpConfig, settingSources, disableSlashCommands, includePartialMessages, maxTurns, maxBudgetUsd, appendSubagentSystemPrompt, addDirs, argvInlineLimit, asAgent }) { // billTo/spawnKind/runId/threadId are consumed by runViaBroker
   return new Promise((resolveP, rejectP) => {
     // Per-model routing env (design §4.4), prepared BEFORE argv: reserved keys
     // are re-dropped here defensively — the write path already rejects them, so
@@ -713,6 +871,14 @@ function runReal({ cwd, systemPrompt, prompt, allowedTools, permissionMode, mode
     // No GitHub credential reaches claude, in any guardrail tier, from a per-project allowlist or a
     // model env alike (src/core/github-credentials.mjs): pushes and PRs are worca's own calls.
     spawnEnv = stripGithubCredentials(spawnEnv ?? process.env);
+    // The broker's own secret never reaches an agent. With the broker on, neither does any
+    // ambient model credential (the boot guard refuses them; this is the second line): the
+    // spawn's broker token is the only one it holds, and it wins over nothing.
+    delete spawnEnv.WORCA_BROKER_SECRET;
+    delete spawnEnv.WORCA_BROKER_SECRET_FILE;
+    if (brokerEnabled()) {
+      for (const k of MODEL_CREDENTIAL_ENV_KEYS) if (k !== 'ANTHROPIC_AUTH_TOKEN' || !safeModelEnv?.ANTHROPIC_AUTH_TOKEN) delete spawnEnv[k];
+    }
 
     // Opt-in spawn diagnostics (WORCA_DEBUG_SPAWN, default off — byte-identical spawn
     // path when unset). Everything here is derived from values already computed above
@@ -735,7 +901,7 @@ function runReal({ cwd, systemPrompt, prompt, allowedTools, permissionMode, mode
 
     // Agent isolation (agent-user.mjs): the same command under the agent's uid, via sudo, in its
     // own process group so a stuck agent can still be SIGKILLed through sudo.
-    const agentId = asAgent ? agentIdentity() : null;
+    const agentId = asAgent ? agentIdentityFor(currentOwner()) : null;   // the owner's pool user (agent-pool.mjs)
     let child;
     try {
       let file = resolved.bin;
@@ -771,6 +937,19 @@ function runReal({ cwd, systemPrompt, prompt, allowedTools, permissionMode, mode
     // STDOUT and exits non-zero with EMPTY stderr. Capture that text so a
     // non-zero exit surfaces the real cause instead of an opaque "no stderr".
     let errorDetail = '';
+    let apiErrorText = '';   // the last "API Error: …" assistant text (API_ERROR_TEXT_RE)
+    // A bridged spawn: the in-process bridge records the upstream's own reason
+    // (bridge/telemetry.mjs 'failure'), matched on this spawn's catalog id + tag
+    // as model-test.mjs does. The last fallback before the CLI's bare notice, so
+    // a CLI that exits without an API Error line still names the real cause.
+    let bridgeFailureText = '';
+    const bridgeKey = bridgeSpawnKey(modelEnv);
+    const onBridgeFailure = (e) => {
+      if (e && e.message && String(e.catalogId || '').toLowerCase() === bridgeKey.catalogId && (e.tag || '') === bridgeKey.tag) {
+        bridgeFailureText = String(e.message);
+      }
+    };
+    if (bridgeKey) bridgeEvents.on('failure', onBridgeFailure);
     let settled = false;
 
     const onAbort = () => {
@@ -800,6 +979,7 @@ function runReal({ cwd, systemPrompt, prompt, allowedTools, permissionMode, mode
       if (settled) return;
       settled = true;
       if (signal) signal.removeEventListener?.('abort', onAbort);
+      if (bridgeKey) bridgeEvents.off('failure', onBridgeFailure);
       cleanupStaged();
       fn(arg);
     };
@@ -822,7 +1002,10 @@ function runReal({ cwd, systemPrompt, prompt, allowedTools, permissionMode, mode
       if (evt?.type === 'system' && evt?.subtype === 'init' && typeof evt.session_id === 'string') {
         safeEmit(onEvent, { type: 'session', sessionId: evt.session_id });
       }
-      if (evt?.type === 'assistant' && text) assistantText += text;
+      if (evt?.type === 'assistant' && text) {
+        assistantText += text;
+        if (API_ERROR_TEXT_RE.test(text.trim())) apiErrorText = text.trim();
+      }
       if (evt?.type === 'result' && typeof evt.result === 'string') resultText += evt.result;
       // Remember the most specific error text we see, for the non-zero-exit path.
       if (evt?.type === 'result' && evt.is_error) {
@@ -867,7 +1050,7 @@ function runReal({ cwd, systemPrompt, prompt, allowedTools, permissionMode, mode
       // Classify BEFORE buffering: the class must see every line ever printed —
       // an early 401 or session-limit notice followed by hundreds of KB of MCP
       // chatter would otherwise scroll past both the trim and the tail cap.
-      stderrClass = strongestClass(stderrClass, classifyError(line));
+      if (!isBenignStderrLine(line)) stderrClass = strongestClass(stderrClass, classifyError(line));
       stderrBuf += line + '\n';        // still the source of the exit-code detail
       // Rolling tail: bound memory against chatty MCP servers. Trim at 4x the
       // cap down to 2x — amortized, and the kept tail always exceeds
@@ -893,8 +1076,12 @@ function runReal({ cwd, systemPrompt, prompt, allowedTools, permissionMode, mode
         return;
       }
       if (code !== 0) {
-        const fromStderr = stderrBuf.trim();
-        const raw = fromStderr || errorDetail || 'no stderr';
+        // Benign notices are not evidence (BENIGN_STDERR_PATTERNS): stderr feeds
+        // the detail only when something else is left, else the stream's own
+        // error wins. A notice alone still beats the opaque "no stderr".
+        const fromStderr = stderrBuf.split('\n').filter((l) => !isBenignStderrLine(l)).join('\n').trim();
+        const streamDetail = errorDetail || apiErrorText || bridgeFailureText;
+        const raw = fromStderr || streamDetail || stderrBuf.trim() || 'no stderr';
         // Tail, not head: the terminal cause sits at the END of a long stderr.
         const detail = raw.length > STDERR_DETAIL_MAX ? `… ${raw.slice(-STDERR_DETAIL_MAX)}` : raw;
         const err = new Error(`${bin} exited with code ${code}: ${detail}`);
@@ -903,7 +1090,11 @@ function runReal({ cwd, systemPrompt, prompt, allowedTools, permissionMode, mode
         // stdout errorDetail. classifyError() returns this stamp verbatim, so
         // the tail cap above can never starve recovery — or flip an early auth
         // failure into 'network' because connection chatter filled the tail.
-        err.errorClass = fromStderr ? stderrClass : classifyError(raw);
+        // A stream-borne API error (a 429 in the result) counts even when real
+        // stderr chatter fed the message.
+        err.errorClass = fromStderr
+          ? strongestClass(stderrClass, streamDetail ? classifyError(streamDetail) : null)
+          : classifyError(raw);
         // Mark the origin channel so the orchestrator can tag its `error` log
         // line with stream:'err' without sniffing the message. Absent when the
         // detail came from the stdout `result` envelope (the common case — see

package/src/core/config.mjs

@@ -25,6 +25,7 @@ const readSettingsHideStored = () => { const s = readSettings(); return typeof s
 import { listPluginModels, allPluginModels, flattenPluginModelEnv } from './plugin-models.mjs';
 // Team policy defaults (team-policy design §6, §8): read from the discovery CACHE only (a leaf module).
 import { policyCatalogModels, teamDefault } from './policy/cache.mjs';
+import { PREDEFINED_LIST_PRICES } from './list-prices.mjs';
 
 /**
  * Recompute the agent step list FRESH from the layered registry (repo agents/ +
@@ -281,6 +282,10 @@ function composeCatalog(projectCustom = [], { projectDir = null } = {}) {
 export function modelHasBaseUrlRouting(modelId) {
   const id = typeof modelId === 'string' ? modelId.trim() : '';
   if (!id) return false;
+  // With the credential broker on, EVERY model is routed (to <broker>/p/<slot>), and the
+  // broker, not a CLI sign-in, authenticates it (claude-auth.mjs must never call a broker
+  // failure "signed out").
+  if (typeof process.env.WORCA_BROKER_URL === 'string' && process.env.WORCA_BROKER_URL.trim()) return true;
   const lc = id.toLowerCase();
   const entry = listGlobalModels().find((m) => m.id.toLowerCase() === lc);
   if (entry) return !!entry.upstream || !!(entry.env && 'ANTHROPIC_BASE_URL' in entry.env);
@@ -496,18 +501,10 @@ export function resolveModelCost(modelId, cliCostUsd, usage, costCfg = undefined
 // is not modelled). cacheWrite = 1.25× input (5-minute TTL), cacheWrite1h = 2×
 // input, cacheRead = 0.1× input except Fable 5.1 (0.025×) and Opus 5.5 (0.05×). Refresh by hand when
 // Anthropic moves a price. PREDEFINED_MODELS itself stays untouched — its entry
-// shape is pinned (test/config-models-global.test.mjs:205).
-export const PREDEFINED_LIST_PRICES = Object.freeze({
-  'claude-fable-5-1':  { input: 10, output: 50, cacheRead: 0.25, cacheWrite: 12.5, cacheWrite1h: 20 },
-  'claude-opus-5-5':   { input: 4,  output: 20, cacheRead: 0.2,  cacheWrite: 5,    cacheWrite1h: 8 },
-  'claude-opus-5':     { input: 5,  output: 25, cacheRead: 0.5,  cacheWrite: 6.25, cacheWrite1h: 10 },
-  'claude-opus-4-8':   { input: 5,  output: 25, cacheRead: 0.5,  cacheWrite: 6.25, cacheWrite1h: 10 },
-  'claude-opus-4-7':   { input: 5,  output: 25, cacheRead: 0.5,  cacheWrite: 6.25, cacheWrite1h: 10 },
-  'claude-opus-4-6':   { input: 5,  output: 25, cacheRead: 0.5,  cacheWrite: 6.25, cacheWrite1h: 10 },
-  'claude-sonnet-5':   { input: 2,  output: 10, cacheRead: 0.2,  cacheWrite: 2.5,  cacheWrite1h: 4 },
-  'claude-sonnet-4-6': { input: 3,  output: 15, cacheRead: 0.3,  cacheWrite: 3.75, cacheWrite1h: 6 },
-  'claude-haiku-4-5':  { input: 1,  output: 5,  cacheRead: 0.1,  cacheWrite: 1.25, cacheWrite1h: 2 },
-});
+// shape is pinned (test/config-models-global.test.mjs:205). The table itself lives
+// in the zero-import leaf list-prices.mjs (the credential broker prices budgets from
+// it too) and is re-exported here for existing importers.
+export { PREDEFINED_LIST_PRICES };
 
 const FREE_RATES = Object.freeze({ input: 0, output: 0, cacheRead: 0, cacheWrite: 0, cacheWrite1h: 0 });
 

package/src/core/failure-policy.mjs

@@ -103,13 +103,15 @@ export const FAILURE_POLICY = Object.freeze({
   }),
   // run()'s setup — checkout, graph build, skills gate — failed with the pipeline
   // row already created. A pause here stamps `setupIncomplete`; resume replays it.
-  setup: Object.freeze({ '*': both(pause(REASON.ERROR)) }),
+  // A usage limit (OpenRouter's daily free requests spent by the Auto classifier, say)
+  // is not a setup bug: it pauses as a usage limit, resumable after the reset.
+  setup: Object.freeze({ usage_limit: both(pause(REASON.USAGE_LIMIT)), '*': both(pause(REASON.ERROR)) }),
   // Before the pipeline row exists (topology, preflight, tool detection) there is
   // nothing to resume into: a launch error is the only enactable verdict.
   launch: Object.freeze({ '*': both(error()) }),
   // Anything that escaped the engine after setup (a scheduler throw, a persist
   // failure, a bookkeeping bug).
-  shell: Object.freeze({ '*': both(pause(REASON.ERROR)) }),
+  shell: Object.freeze({ usage_limit: both(pause(REASON.USAGE_LIMIT)), '*': both(pause(REASON.ERROR)) }),
   // resume() could not REHYDRATE the paused run — the checkout is gone, run.json
   // is corrupt, a guardrail set or agent prompt no longer loads. The point on disk
   // is already the best the run can offer: parking it again would re-persist the

package/src/core/git-info.mjs

@@ -6,9 +6,9 @@
 // never shell out to real git/gh/GitHub. Nothing here ever throws.
 
 import { spawn } from 'node:child_process';
-import { mkdtemp, writeFile, rm } from 'node:fs/promises';
+import { mkdtemp, writeFile, rm, readFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { join, isAbsolute } from 'node:path';
 import { githubEnv, readGithubCredentials } from './github-credentials.mjs';
 
 /** Default runner: spawn `cmd args` in `cwd`, resolve { ok, stdout, stderr, code }. */
@@ -175,13 +175,57 @@ const ownerRepoOfPrUrl = (url) => { const m = /^https:\/\/github\.com\/([^/]+\/[
 /** "owner/name" from gh's `[HOST/]OWNER/REPO`, or null. */
 const ownerRepo = (repo) => (repo ? String(repo).split('/').slice(-2).join('/') : null);
 
-/** Push the branch to `remote` (default origin) and set upstream. Idempotent; surfaces stderr. */
-export async function pushBranch(projectDir, branch, remote = 'origin') {
+/**
+ * The remote could not read the pack we sent ("remote: error: inflate: data stream error",
+ * "pack has bad object at offset N", "unpack failed: index-pack failed"). git streams stored
+ * objects to a remote without re-checking them, so this surfaces only there. Seen once on a
+ * hosted worca (a blob:none partial clone, 2026-09-27) while other git writers were busy in
+ * the same object store — a background `gc --auto` repacking ~12,500 loose objects and the
+ * team-metrics flush; the same push rebuilt afterwards was clean. Pure.
+ */
+export function isRemotePackFailure(stderr) {
+  return /unpack failed|index-pack (?:failed|abnormal exit)|pack has bad object|inflate: data stream error|bad pack header|unpacker error|did not receive expected object/i.test(String(stderr || ''));
+}
+
+/** A `git gc` running in this repository right now (its gc.pid names a live process here). */
+async function gcRunning(projectDir) {
+  const r = await _run('git', ['rev-parse', '--git-common-dir'], { cwd: projectDir });
+  if (!r.ok) return false;
+  const common = r.stdout.trim();
+  let text;
+  try { text = await readFile(join(isAbsolute(common) ? common : join(projectDir, common), 'gc.pid'), 'utf8'); } catch { return false; }
+  const pid = Number.parseInt(String(text).trim().split(/\s+/)[0], 10);
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try { process.kill(pid, 0); return true; } catch (err) { return err.code === 'EPERM'; }
+}
+
+/** Wait (up to `maxMs`) for a running `git gc` in the repository to finish. */
+async function waitForGc(projectDir, { maxMs = 120_000, stepMs = 2_000, sleep = (ms) => new Promise((r) => setTimeout(r, ms)) } = {}) {
+  const until = Date.now() + maxMs;
+  while (Date.now() < until && await gcRunning(projectDir)) await sleep(stepMs);
+}
+
+/**
+ * Push the branch to `remote` (default origin) and set upstream. Idempotent; surfaces stderr.
+ * A pack the remote could not read (isRemotePackFailure) is pushed once more, after any running
+ * `git gc` in the repository finished, as a self-contained pack (--no-thin: no delta against
+ * objects the remote has, which a partial clone may not hold).
+ */
+export async function pushBranch(projectDir, branch, remote = 'origin', { gcWait = {} } = {}) {
   const r0 = remote || 'origin';
   const cred = await githubEnv('write', { repo: await githubRepoOf(projectDir, r0) });
   if (cred.error) return { ok: false, stderr: cred.error };
   const r = await _run('git', ['push', '-u', r0, branch], { cwd: projectDir, env: cred.env });
-  return { ok: r.ok, stderr: (r.stderr || '').trim() };
+  if (r.ok || !isRemotePackFailure(r.stderr)) return { ok: r.ok, stderr: (r.stderr || '').trim() };
+  await waitForGc(projectDir, gcWait);
+  const again = await _run('git', ['push', '--no-thin', '-u', r0, branch], { cwd: projectDir, env: cred.env });
+  if (again.ok) return { ok: true, stderr: (again.stderr || '').trim(), retried: true };
+  return {
+    ok: false,
+    retried: true,
+    stderr: `${(again.stderr || '').trim()}\n(the remote could not read the pack git sent, twice — a second push waited for ` +
+      'any running git gc and sent a self-contained pack. Check the local repository with `git fsck --full`.)',
+  };
 }
 
 /**

package/src/core/github-credentials.mjs

@@ -13,6 +13,8 @@
 //    variable only worca sets. No global `gh auth setup-git` is needed.
 // credentialEnv is pure (token modes); githubEnv also mints in App mode.
 import { appConfigured, loadAppConfig, mintInstallationToken } from './github-app.mjs';
+import { currentBillTo } from './billing.mjs';
+import { personGithubToken } from './broker-client.mjs';
 
 /** Every variable that carries a GitHub credential. Never reaches an agent. */
 export const GITHUB_CREDENTIAL_KEYS = Object.freeze([
@@ -67,7 +69,15 @@ export function credentialEnv(role, base = process.env) {
  * for this one call (`repo` "owner/name" helps find the installation). Never throws:
  * `{ env, error }`, where a failed mint leaves a credential-free env and says why.
  */
-export async function githubEnv(role, { base = process.env, repo = null, fetchImpl = fetch, now = Date.now() } = {}) {
+export async function githubEnv(role, { base = process.env, repo = null, fetchImpl = fetch, now = Date.now(), asPerson = true, person = undefined } = {}) {
+  // "Push as me" (optional, docs/credential-broker.md): a write (push, pull request) goes out
+  // with the acting person's own GitHub token, from the credential broker, for this call only.
+  //   WORCA_GH_AS_PERSON=prefer    their token when they connected GitHub, else the App/token below
+  //   WORCA_GH_AS_PERSON=required  their token or nothing: the push fails and says how to connect
+  if (role === 'write' && asPerson) {
+    const p = await personWriteEnv(base, person === undefined ? currentBillTo() : person);
+    if (p) return p;
+  }
   if (readGithubCredentials(base).mode !== 'app') return { env: credentialEnv(role, base), error: null };
   try {
     const { token } = await mintInstallationToken(loadAppConfig(base), { role, repo, fetchImpl, now });
@@ -77,6 +87,39 @@ export async function githubEnv(role, { base = process.env, repo = null, fetchIm
   }
 }
 
+/** WORCA_GH_AS_PERSON: 'prefer' | 'required' | null (off). Needs the credential broker. */
+export function asPersonMode(env = process.env) {
+  const v = String(env.WORCA_GH_AS_PERSON || '').trim().toLowerCase();
+  if (!(typeof env.WORCA_BROKER_URL === 'string' && env.WORCA_BROKER_URL.trim())) return null;
+  return v === 'prefer' || v === 'required' ? v : null;
+}
+
+/**
+ * The write env with `person`'s own token, `{env, error}` when "push as me" decides the
+ * call (their token, or — in required mode — a refusal), or null to fall through to
+ * worca's own credential (off, or prefer mode without a connected GitHub).
+ */
+async function personWriteEnv(base, person) {
+  const mode = asPersonMode(base);
+  if (!mode) return null;
+  const who = typeof person === 'string' && person.includes('@') ? person : null;
+  if (!who) {
+    return mode === 'required'
+      ? { env: stripGithubCredentials(base), error: 'pushes go out as the person who acted (WORCA_GH_AS_PERSON=required), and nobody signed in is behind this one' }
+      : null;
+  }
+  try {
+    const { token } = await personGithubToken(who);
+    return { env: withToken(base, token), error: null, as: who };
+  } catch (err) {
+    if (mode === 'required') {
+      return { env: stripGithubCredentials(base), error: `pushing as ${who}: ${err.message.replace(/^credential broker: /, '')}` };
+    }
+    if (err.code !== 'not_connected') console.warn(`[worca] push as ${who}: ${err.message}; using worca's own GitHub credential`);
+    return null;
+  }
+}
+
 function withToken(base, token) {
   const env = stripGithubCredentials(base);
   if (!token) return env;

package/src/core/graph/script-runner.mjs

@@ -21,6 +21,8 @@ import { DEFAULT_EXIT_CODES, DEFAULT_TIMEOUT_MS, MIN_TIMEOUT_MS, MAX_TIMEOUT_MS,
 import { probePython } from './python-probe.mjs';
 import { stripGithubCredentials } from '../github-credentials.mjs';
 import { agentIdentity, agentSpawn, killAgentGroupSync } from '../agent-user.mjs';
+import { agentIdentityFor } from '../agent-pool.mjs';
+import { currentOwner } from '../billing.mjs';
 
 const CHILD_PATH = fileURLToPath(new URL('./script-child.mjs', import.meta.url));
 /** The `python` harness (workbench spec §7), spawned as `<python> -u worca_script.py <program.py>`. */
@@ -283,7 +285,7 @@ export function spawnScript({ file, args, cwd, env, stdin = null, timeoutMs, sig
   return new Promise((resolve, reject) => {
     const started = Date.now();
     // Scripts run the agents' code (tests, builds): under the agent's uid when the container has one.
-    const agent = platform !== 'win32' ? agentIdentity() : null;
+    const agent = platform !== 'win32' ? agentIdentityFor(currentOwner()) : null;   // the owner's pool user (agent-pool.mjs)
     let spawnFile = file;
     let spawnArgs = args;
     let spawnEnv = env;

package/src/core/list-prices.mjs

@@ -0,0 +1,29 @@
+// src/core/list-prices.mjs
+// Anthropic list prices for the built-in model ids, in USD per MILLION tokens.
+// A zero-import leaf so both config.mjs (the chat footer's live estimate) and the
+// credential broker (src/broker/usage.mjs: per-person budgets) price from one table.
+//
+// From Anthropic's published pricing (platform.claude.com/docs/en/pricing — snapshot
+// 2026-06-24; Opus 5.5 added 2026-09-22). `[1m]` twins and dated ids resolve to their
+// base row (the long-context premium is not modelled). cacheWrite = 1.25× input
+// (5-minute TTL), cacheWrite1h = 2× input, cacheRead = 0.1× input except Fable 5.1
+// (0.025×) and Opus 5.5 (0.05×). Refresh by hand when Anthropic moves a price.
+export const PREDEFINED_LIST_PRICES = Object.freeze({
+  'claude-fable-5-1':  { input: 10, output: 50, cacheRead: 0.25, cacheWrite: 12.5, cacheWrite1h: 20 },
+  'claude-opus-5-5':   { input: 4,  output: 20, cacheRead: 0.2,  cacheWrite: 5,    cacheWrite1h: 8 },
+  'claude-opus-5':     { input: 5,  output: 25, cacheRead: 0.5,  cacheWrite: 6.25, cacheWrite1h: 10 },
+  'claude-opus-4-8':   { input: 5,  output: 25, cacheRead: 0.5,  cacheWrite: 6.25, cacheWrite1h: 10 },
+  'claude-opus-4-7':   { input: 5,  output: 25, cacheRead: 0.5,  cacheWrite: 6.25, cacheWrite1h: 10 },
+  'claude-opus-4-6':   { input: 5,  output: 25, cacheRead: 0.5,  cacheWrite: 6.25, cacheWrite1h: 10 },
+  'claude-sonnet-5':   { input: 2,  output: 10, cacheRead: 0.2,  cacheWrite: 2.5,  cacheWrite1h: 4 },
+  'claude-sonnet-4-6': { input: 3,  output: 15, cacheRead: 0.3,  cacheWrite: 3.75, cacheWrite1h: 6 },
+  'claude-haiku-4-5':  { input: 1,  output: 5,  cacheRead: 0.1,  cacheWrite: 1.25, cacheWrite1h: 2 },
+});
+
+/** The list-price row for a model id (`[1m]` twins and dated ids map to their base), or null. */
+export function listPriceFor(modelId) {
+  const id = typeof modelId === 'string' ? modelId.trim().toLowerCase() : '';
+  if (!id) return null;
+  const base = id.replace(/\[1m\]$/, '').replace(/-\d{8}$/, '');
+  return PREDEFINED_LIST_PRICES[base] ?? null;
+}

package/src/core/mcp-secrets.mjs

@@ -0,0 +1,80 @@
+// src/core/mcp-secrets.mjs
+// Secrets in the MCP server definitions a run hands its agents (credential broker,
+// docs/credential-broker.md). A run's --mcp-config merges each project's MCP servers and
+// the local-scope ones from worca's own ~/.claude.json; whatever an entry carries in its
+// `env`, `headers` or URL reaches the agent: the server process runs as the agent user
+// with that environment, and the config file is readable to it. That is the one class
+// of credential agents could still read once model keys live in the broker.
+//
+// A literal secret-looking value is a finding; a whole `${VAR}` reference is not: the CLI
+// expands it from the agent's own environment, so the secret is only there if the operator
+// put it in worca's environment on purpose (where agents can read it just the same).
+//   WORCA_MCP_SECRETS = block | warn | off   default: block with the broker on, else warn.
+// block drops the server from the run's config and says so; warn only says so. Values are
+// never printed. Pure.
+
+const SECRET_NAME_RE = /(^|[_-])(TOKEN|KEY|SECRET|PASSWORD|PASSWD|CREDENTIALS?|AUTH|COOKIE|SESSION)([_-]|$)|authorization|api[-_]?key|x-api-key|bearer/i;
+const QUERY_SECRET_RE = /^(api[-_]?key|key|token|access[-_]?token|secret|password|auth|sig|signature)$/i;
+const REF_RE = /^\$\{[A-Za-z_][A-Za-z0-9_]*(:-[^}]*)?\}$/;
+const TOKEN_SHAPE_RE = /\b(sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[abpr]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16}|eyJ[A-Za-z0-9_-]{10,}\.)/;
+
+export const MCP_SECRET_MODES = Object.freeze(['block', 'warn', 'off']);
+
+/** The effective mode: WORCA_MCP_SECRETS, else block with the broker on, else warn. */
+export function mcpSecretsMode(env = process.env) {
+  const v = String(env.WORCA_MCP_SECRETS || '').trim().toLowerCase();
+  if (MCP_SECRET_MODES.includes(v)) return v;
+  return typeof env.WORCA_BROKER_URL === 'string' && env.WORCA_BROKER_URL.trim() ? 'block' : 'warn';
+}
+
+const literal = (v) => typeof v === 'string' && v.trim() !== '' && !REF_RE.test(v.trim());
+/** Bearer ${VAR} and the like: a reference with a fixed scheme word is still a reference. */
+const refOnly = (v) => /^(Bearer|Basic|token)\s+\$\{[A-Za-z_][A-Za-z0-9_]*\}$/i.test(String(v).trim());
+
+/** Where one server definition carries a literal secret: ['env LINEAR_API_KEY', 'header Authorization', …]. */
+export function mcpSecretFindings(def) {
+  const out = [];
+  if (!def || typeof def !== 'object') return out;
+  for (const [k, v] of Object.entries(def.env || {})) {
+    if (literal(v) && (SECRET_NAME_RE.test(k) || TOKEN_SHAPE_RE.test(v))) out.push(`env ${k}`);
+  }
+  for (const [k, v] of Object.entries(def.headers || {})) {
+    if (literal(v) && !refOnly(v) && (SECRET_NAME_RE.test(k) || TOKEN_SHAPE_RE.test(v))) out.push(`header ${k}`);
+  }
+  if (typeof def.url === 'string') {
+    try {
+      const u = new URL(def.url);
+      if (u.password || u.username) out.push('credentials in the URL');
+      for (const [k, v] of u.searchParams) if (QUERY_SECRET_RE.test(k) && literal(v)) out.push(`URL parameter ${k}`);
+    } catch { /* not a URL: nothing to find */ }
+  }
+  for (const a of Array.isArray(def.args) ? def.args : []) {
+    if (typeof a === 'string' && TOKEN_SHAPE_RE.test(a)) { out.push('a token in args'); break; }
+  }
+  return out;
+}
+
+/**
+ * Screen a run's MCP servers. `block` drops the ones carrying a literal secret.
+ * @returns {{servers: Record<string, object>, warnings: string[], dropped: string[]}}
+ */
+export function screenMcpSecrets(servers, { mode = 'warn' } = {}) {
+  if (mode === 'off') return { servers, warnings: [], dropped: [] };
+  const kept = {};
+  const warnings = [];
+  const dropped = [];
+  for (const [name, def] of Object.entries(servers || {})) {
+    const f = mcpSecretFindings(def);
+    if (!f.length) { kept[name] = def; continue; }
+    const where = f.join(', ');
+    if (mode === 'block') {
+      dropped.push(name);
+      warnings.push(`MCP server \`${name}\` was left out of this run: it carries a secret (${where}) that its agents could read. ` +
+        'Remove the secret from its definition, or set WORCA_MCP_SECRETS=warn to accept that agents can read it.');
+    } else {
+      kept[name] = def;
+      warnings.push(`MCP server \`${name}\` carries a secret (${where}); the run's agents can read it.`);
+    }
+  }
+  return { servers: kept, warnings, dropped };
+}